Cloudanix VulnDB

CVE-2026-45704

High · 7.1

Pimcore has a CustomReports Share Bypass

CVSS

7.1

EPSS

0.4%

Published

May 27, 2026

CISA due date

—

The record

`CustomReports` uses inconsistent authorization between the report listing endpoint and the report detail endpoint. - The listing flow filters reports based on report-sharing rules - The detail flow only checks generic `reports` or `reports_config` permissions As a result, a low-privileged backend user who was not granted access to a report can still read that report directly by name even though it does not appear in the user's visible report list. In the local Docker reproduction: - The report `poc-secret-report` was not visible to the low-privileged user in the report list - The same user was still able to retrieve the report configuration directly by name

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities